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DETAILED ACTION 

1 . Claims 1-37 have been re-examined and are pending with this action. 



Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent in the United 
States. 

2. Claims 1-10 are rejected under 35 U.S.C. 102(b) as being anticipated by Tajalli 
etal. (US 5,361,359 A). 

As per claim 1 , Tajalli teaches an apparatus for creating an audit trail for an 
application program (see col. 4, lines 54-59 and col.6, lines 63-65), wherein the 
application program defines one or more business components (see col.1 , lines 24-38) 
and is executable on an application server, the apparatus comprising: means for 
selecting: the business components to be audited from the one or more business 
components (see col.1, lines 24-38: "inventory records" and col.7, lines 1-14); and one 
or more operations to be audited (see col.6, lines 63-65 and col.1 5, line 61 to col. 16, 
line 9); wherein the means for selecting the business components to be audited and the 
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operations to be audited is included in the application program (implicit: see col .7, lines 
9-14 and col. 16, lines 16-24). 

As per claim 2, Tajalli further teaches wherein the application program further 
comprises: means for detecting when the selected operations are performed (see 
col. 18, lines 45-50). 

As per claim 3, Tajalli further teaches wherein the application program further 
comprises: means for generating an audit transaction record regarding the business 
component when the selected operations are detected (see col .7, lines 1-3 and col. 16, 
lines 30-36). 

As per claim 4, Tajalli further teaches wherein the operations include at least one 
of: update, add, copy, and delete (see col.10, lines 7-13). 

As per claim 5, Tajalli teaches of further comprising user interface means for 
allowing the user to restrict access to the audit trail by at least one of: an employee 
identifier, an employment position, and an area of responsibility (see col. 15, line 66 to 
col. 16, line 1). 

As per claim 6, Tajalli teaches of further comprising means for storing the audit 
transaction record in an external database (see Fig.1 and Fig.3, #118). 

As per claims 7, Tajalli teaches of further comprising means for storing the audit 
transaction record in a file (see Fig.1, #119). 

As per claim 8, Tajalli teaches of further comprising means for importing the audit 
transaction record stored in the file to a database (see col. 16, lines 44-46). 
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As per claim 9, Tajalli further teaches wherein the audit transaction record 
includes at least one of: an identifier for the entity that accessed the business 
component or the field, the operation that was performed on the business component, 
when the operation was performed, a previous value of the field, a current value of the 
field, and how the value of at least a portion of the business component was changed 
(see col. 16, lines 16-24; "identity of any "objects" accessed"). 

As per claim 10, Tajalli teaches of further comprising means for allowing the user 
to query one or more of the audit transaction records (implicit: see col. 17, lines 14-15). 



Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

3. Claims 12-22, 24-32 and 34-37 are rejected under 35 U.S.C. 103(a) as being 

unpatentable over Tajalli et al. (US 5,361 ,359 A) in view of Smaha et al. (US 5,557,742 

A). 

INDEPENDENT: 

As per claim 14, Tajalli teaches a system for creating an audit trail in an 
information system (see col .4, lines 54-59 and col .6, lines 63-65), comprising: an 
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application program (see col.2, lines 32-49) comprising: at least one business 
component (see col.1 , lines 24-38: "inventory records"); a user interface operable to 
allow a user to select: one or more operations to be audited on (see col .6, line 67 to 
col.7, line 4 and col. 16, lines 16-24: "configuration data... may indicate which requests 
are to be audited"); a set of instructions operable to detect when the selected operations 
are performed (see col. 18, lines 45-50); and a set of instructions operable to generate 
an audit transaction record when the selected operations are detected (see col.7, lines 
1-3). 

Although Tajalli teaches of business components (see col.1 , lines 24-38: 
"inventory records"), Tajalli does not explicitly teach of one or more fields selectable by 
a user. Smaha teaches of one or more fields selectable by a user (see Fig.6b, #1 72 & 
#174; and col.1 1, lines 9-13). 

It would have been obvious to a person of ordinary skill in the art at the time the 
invention was made to employ the teachings of Smaha within the system of Tajalli by 
implementing one or more selectable fields within the business component of the 
system for creating an audit trail in an information system because such an 
implementation enables the "administrator" to specify further the "audit configuration 
data" (see Tajalli: col. 16, lines 16-24) for "identifying particular usage patterns that are 
likely to indicate unauthorized use" (see Tajalli: col.1 7, lines 16-19) and Smaha teaches 
that "many processing systems support sophisticated event notification and alarm 
systems" (see Smaha: col. 10, lines 62-65). Therefore, one of ordinary skill in the art 
would employ additional field within the components to further specify audit 
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configuration data to better assess an indication of unauthorized use and "accurately 
monitor system uses" (see Tajalli: col. 7, lines 9-10). 

As per claim 24, Tajalli teaches a method for creating an audit trail in an 
information system (see col.4, lines 54-59 and col.6, lines 63-65), the method 
comprising; performing audit trail functions in an application program (see abstract and 
col. 16, lines 13-24) including: generating a list of business components (see col.1, lines 
24-38: "inventory records") included in the application program (implicit: see col. 16, lines 
1 3-1 5 "request is in the set of requests to be audited"); allowing the user to select one or 
more of the business components to be audited (see col.6, line 67 to col.7, line 4 and 
col. 16, lines 16-24); and allowing the user to select one or more of the operations to be 
audited for the selected business components (see col. 16, lines 1 1-24). 

Although Tajalli teaches of business components (see col.1 , lines 24-38: 
"inventory records"), Tajalli does not explicitly teach of presenting a list and the 
operations that can be performed to the user. Smaha teaches of presenting a list and 
the operations that can be performed to the user (see col.9, lines 1-3 & 8-14). 

It would have been obvious to a person of ordinary skill in the art at the time the 
invention was made to employ the teachings of Smaha within the system of Tajalli by 
implementing presenting a list and the operations that can be performed to the user 
within the business component of the method for creating an audit trail in an information 
system because such an implementation enables the "administrator" to specify further 
the "audit configuration data" (see Tajalli: col. 16, lines 16-24) for "identifying particular 
usage patterns that are likely to indicate unauthorized use" (see Tajalli: col. 17, lines 16- 
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19) and Smaha teaches that "selection process 120 allows a user to control the present 
embodiment to further limit the misuses for which to search from the maximum set of all 
misuses" (see Smaha: col. 8, lines 63-66). Therefore, one of ordinary skill in the art 
would employ presenting a list and the operations that can be performed to the 
user/administrator so that the user/administrator may accurately have more control of 
limiting misuses "to the extent he desires" (see Tajalli: col. 7, lines 9-10). 
DEPENDENT: 

As per claims 12 and 34, Tajalli and Smaha further teaches wherein the one or 
more business components comprise one or more fields, and further comprising: means 
for selecting the one or more fields to be audited; and means for generating an audit 
transaction record when one of the selected operations on one of the selected fields is 
detected (see claim 14 rejection above). 

As per claims 13, 22 and 35, Tajalli does not explicitly teach of further comprising 
means for allowing the user to restore the one or more of the fields to a previous state 
or value. Smaha teaches of allowing the user to restore the one or more of the fields to 
a previous state or value (see col.9, lines 49-55). It would have been obvious to a 
person of ordinary skill in the art at the time the invention was made to employ the 
teachings of Smaha within the system of Tajalli by implementing restoring the one or 
more of the fields to a previous state or value within the apparatus, system and method 
for creating an audit trail for an application program in an information system because 
such functionality allows the system to go back to the state prior to a "misuse". 
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As per claims 15 and 25, Tajalli further teaches wherein the operations include at 
least one of: update, add, copy, and delete (see claim 4 rejection above). 

As per claims 16 and 26, Tajalli teaches of further comprising user interface 
means for allowing the user to restrict access to the audit trail by at least one of: an 
employee identifier, an employment position, and an area of responsibility (see claim 5 
rejection above). 

As per claims 17 and 28, Tajalli teaches of further comprising means for storing 
the audit transaction record in an external database (see claim 6 rejection above). 

As per claims 18 and 29, Tajalli teaches of further comprising means for storing 
the audit transaction record in a file (see claim 7 rejection above). 

As per claims 19 and 30, Tajalli teaches of further comprising means for 
importing the audit transaction record stored in the file to a database (see claim 8 
rejection above). 

As per claims 20 and 31 , Tajalli further teaches wherein the audit transaction 
record includes at least one of: an identifier for the entity that accessed the business 
component or the field, the operation that was performed on the business component, 
when the operation was performed, a previous value of the field, a current value of the 
field, and how the value of at least a portion of the business component was changed 
(see claim 9 rejection above). 

As per claims 21 and 32, Tajalli teaches of further comprising means for allowing 
the user to query one or more of the audit transaction records (see claim 10 rejection 
above). 
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As per claim 27, Tajalli teaches of further comprising: detecting when the 
selected operations are performed on one of the selected business components; and 
generating an audit transaction record when the selected operations are detected (see 
claim 2 and 3 rejections above). 

As per claim 36, Tajalli and Smaha further teach of a computer program product 
comprising: instructions for implementing the method of claim 24 (see Tajalli: col. 15, 
lines 48-52 and Smaha: col. 3, lines 56-58). 

As per claim 37, Tajalli and Smaha further teach of a data signal comprising: 
instructions for implementing the method of claim 24 (implicit: see Tajalli: col. 15, lines 
48-52; col. 17, line 6; and Smaha: col. 3, lines 41 & 56-58). 

4. Claims 1 1 is rejected under 35 U.S.C. 103(a) as being unpatentable over Tajalli 
et al. (US 5,361,359 A) in view of Darnell et al. (US 5,596,700 A). 

As per claim 1 1 , Tajalli does not explicitly teach of further comprising means for 
prompting the user to enter a comment or a description of the operation when the 
selected operations are detected. Darnell teaches of prompting the user to enter a 
comment or a description of the operation when the selected operations are detected 
(see col.3, lines 19-24 and col.11, lines 30-31). It would have been obvious to a person 
of ordinary skill in the art at the time the invention was made to employ the teachings of 
within the system of Tajalli by implementing prompting the user to enter a comment or a 
description of the operation when the selected operations are detected within the 
apparatus of creating an audit trail for an application program because such an 
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implementation provide numerous benefits similar to the functionality of writing notes on 
paper (see Darnell: col.1 , lines 42-44), notepads or sticky pads (i.e., for reminders or 
sharing information with others). 

5. Claims 23 and 33 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Tajalli et al. (US 5,361 ,359 A) and Smaha et al. (US 5,557,742 A) further in view of 
Darnell et al. (US 5,596,700 A). 

As per claims 23 and 33, Tajalli and Smaha do not explicitly teach of further 
comprising means for prompting the user to enter a comment or a description of the 
operation when the selected operations are detected. Darnell teaches of prompting the 
user to enter a comment or a description of the operation when the selected operations 
are detected (see claim 1 1 rejection above). 



Response to Arguments 

6. Applicant's arguments filed March 18, 2005 have been fully considered but they 
are not persuasive. 

A. In response to the argument regarding independent claim 1 , Tajalli clearly 
teaches the limitation "wherein the means for selecting the business components to be 
audited and the operations to be audited is included in the application program". 
Additional reference locations have been provided to clear any ambiguities. In col. 16, 
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lines 13-24, Tajalli teaches of an "audit configuration data" which indicates requests to 
be audited and which can be specified by an administrator ("means for selecting") and is 
employed by the AA system. An application program is merely a program to perform an 
application such as the functions taught above and therefore inherent, therefore 
because Tajalli teaches the functions of a "means for selecting" it is inherent that an 
application program provides such means. 

Furthermore, the cited excerpt from Tajalli by the applicant, column 15, lines 20- 
24, is merely teaching that another application program cannot interfere with the 
"auditing or the storage of usage auditing in any way" and not the application program 
performing the auditing itself. It is noted that there are plurality of application programs 
and just because Tajalli mentions the term "application program" does not explicitly 
imply that the application program is the program performing the auditing. Also, Tajalli 
is teaching that an application program and user cannot affect the process of auditing 
and the storage of the collected data. These are during and post-auditing processes 
and not pre-auditing steps as recited in the claims. Column 7, lines 5-8, again reiterates 
that the "application programs and ordinary users... are prevented from disabling the 

auditing specified by the administrator and from erasing or modifying the audit data 

) 

collected". 

For the reasons above and with respect to the rejections above, dependent 
claims 2-13 remain rejected. 
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B. In response to the argument regarding independent claim 14, Tajalli 
clearly teaches the broad limitation of allowing a user to "select: one or more operations 
to be audited on". See rejection above and see col. 7, line 7, "auditing specified by the 
administrator". 

Since Tajalli does not explicitly teach of fields, Smaha is relied upon to further 
teach this limitation. The cited reference location col.1 1 , lines 9-1 3, clearly and explicitly 
teach of fields selectable by a user. In response to applicant's arguments against the 
references individually, one cannot show nonobviousness by attacking references 
individually where the rejections are based on combinations of references. See In re 
Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In re Merck & Co., 800 F.2d 1091, 
231 USPQ 375 (Fed. Cir. 1986). The combination of the two references clearly teaches 
the broad recited claim limitation. 

In response to the arguments regarding the "set of instructions operable to 
detect..." and the "set of instructions operable to generate...", it is implicit that the 
detection and the generation is a function of an application program that within the AA 
system. 

For the reasons above and with respect to the rejections above, dependent 
claims 15-23 remain rejected. Similar to the rejection of claim 14, claims 12 and 34 
remain rejected. 

C. In response to the argument regarding independent claim 24, Tajalli 
clearly teaches the limitation of "performing audit trail functions in an application 



Application/Control Number: 09/963,292 Page 13 

Art Unit: 2155 

program". In the abstract, Tajalli teaches "A system and a method for auditing and 
controlling the use of a computer. An operating system and selected programs and 
data, referred to as approved applications and approved data, are stored on a protected 
media" which clearly teaches that the system is an application program to perform the 
functions of auditing. 

The cited reference locations clearly imply that the requests may be business 
components to be audited. 

For the reasons above and with respect to the rejections above, dependent 
claims 25-37 remain rejected. 

D. In response to the argument regarding dependent claims 13, 22, and 35, 
Smaha further teaches in col .8, lines 63-66, that a user is given the control in the 
present embodiment of the invention. 

E. In response to applicant's arguments regarding dependent claims 1 1 , 23, 
and 33, against the references individually, one cannot show nonobviousness by 
attacking references individually where the rejections are based on combinations of 
references. See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981 ); In re Merck & 
Co., 800 F.2d 1091, 231 USPQ 375 (Fed. Cir. 1986). The limitation of "operation that 
has been selected for auditing" is taught by Tajalli and therefore Darnell is not relied 
upon. 
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7. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1 .1 36(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .1 36(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 

8. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Michael Y. Won whose telephone number is 571-272- 
3993. The examiner can normally be reached on M-Th: 7AM-5PM. 

The fax phone number for the organization where this application or proceeding 
is assigned is 703-872-9306. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 

Michael Won 





May 24, 2005 



